Vinyl Cache and Varnish Cache: Project Evolution

Date: 2026-04-08

It has come to our attention via user and distribution maintainer feedback that the current relationship between Vinyl Cache and Varnish Cache may be confusing. To clarify: the open-source (FOSS) project previously known as Varnish Cache has officially rebranded as Vinyl Cache.

For a deeper dive into the reasoning behind this shift, please refer to the article: "20 years old and it is time to get serious(er)".

The following sections have been formally ratified by the Vinyl Cache Governing Board.

---

🔄 The Transition Process

Since the initial announcement coinciding with the release of Varnish Cache 8.0, the team (now the Vinyl Cache Team) has worked diligently to implement this rebranding. This process culminated in the launch of version 9.0 on 2026-03-16.

Summary of Changes

• Web Presence: The primary domain is now https://vinyl-cache.org. It mirrors all legacy content previously found at https://varnish-cache.org.
• Brand Identity: The project has adopted a fresh identity, including a new mascot, logo, and color palette.
• Naming: While the FOSS project is now Vinyl Cache, efforts were made to maintain the "Varnish Cache" name for legacy compatibility...

---

🛡️ Security Advisory Archive

Below is the comprehensive list of security vulnerabilities tracked by the project.

ID	Vulnerability Description
VSV00019	HTTP/2 parsing deficiency
VSV00018	Absolute form parsing deficiency in Varnish Cache
VSV00017	Varnish HTTP/2 "Made You Reset" Attack
VSV00016	Request Smuggling Attack
VSV00015	Varnish HTTP/1 client-side desync
VSV00014	Varnish HTTP/2 "Broke Window" Attack
VSV00013	Varnish HTTP/2 "Rapid Reset" Attack
VSV00012	vmod-digest Base64 decoding flaw
VSV00011	Varnish HTTP/2 Request Forgery
VSV00010	Varnish Request Smuggling
VSV00009	Varnish Denial of Service (DoS)
VSV00008	Varnish HTTP/1 Request Smuggling
VSV00007	Varnish HTTP/2 Request Smuggling
VSV00006	varnish-modules Denial of Service
VSV00005	Varnish HTTP Proxy Protocol V2 DoS
VSV00004	Workspace information leak
VSV00003	DoS attack vector (including VCL mitigation)
VSV00002	Data leak via -sfile Stevedore transient objects
VSV00001	General DoS vulnerability

---

📦 Software Releases

Current Stable Versions

• Vinyl Cache: 9.0.1
• Varnish Cache: 8.0.2 / 6.0.18

Legacy Version History

The project maintains a vast archive of previous builds. The versioning progression can be viewed as: $\text{Version}_{current} \approx \text{Vinyl 9.x} \rightarrow \text{Varnish 8.x} \rightarrow \text{Varnish 7.x} \dots \rightarrow \text{Varnish 0.9}$

Detailed Release List:

• Vinyl Cache: 9.0.0
• Varnish Cache 8.x: 8.0.1, 8.0.0
• Varnish Cache 7.x: 7.7.3, 7.7.2, 7.7.1, 7.7.0, 7.6.5, 7.6.4, 7.6.3, 7.6.2, 7.6.1, 7.6.0, 7.5.0, 7.4.3, 7.4.2, 7.4.1, 7.4.0, 7.3.2, 7.3.1, 7.3.0, 7.2.1, 7.2.0, 7.1.2, 7.1.1, 7.1.0, 7.0.3, 7.0.2, 7.0.1, 7.0.0
• Varnish Cache 6.x: 6.6.2, 6.6.1, 6.6.0, 6.5.2, 6.5.1, 6.5.0, 6.4.0, 6.3.2, 6.3.1, 6.3.0, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.1, 6.1.0, 6.0.17, 6.0.16, 6.0.15, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
• Varnish Cache 5.x: 5.2.1, 5.2.0, 5.1.3, 5.1.2, 5.1.1, 5.0.0
• Varnish Cache 4.x: 4.1.11 down to 4.1.0, 4.0.5 down to 4.0.0
• Varnish Cache 3.x: 3.0.7 down to 3.0.0
• Varnish Cache 2.x: 2.1.5 down to 2.1, 2.0.6 down to 2.0, 2.0.1
• Varnish Cache 1.x: 1.1.2, 1.1.1, 1.1, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0
• Early Versions: 0.9.1, 0.9

---

📚 Documentation & Resources

Tutorials and Guides

• VMODs:
  • Using re2 and selector for sets.
  • Managing files with VMOD file.
  • Header filtering via VMOD re2 sets.
• Configuration:
  • TLS setup using haproxy.
  • Crash detection for Vinyl Cache.
  • VCL Snippets (e.g., 301/302 Redirects).
• Operations:
  • Analyzing varnishlog.
  • Handling FetchError and backend failures.
  • Upgrading from legacy versions.
  • VCL language versioning.
• Advanced:
  • Alpine Linux compilation.
  • Cookie signing and Signed URL validation.
  • Integrating Iocaine with Vinyl Cache.

Support & Development

• Getting Help: Community resources.
• Business: VMOD modules and registration.
• Developer Hub: Documentation writing and governance.

---

⚖️ Governance & Project News

Official Updates

• Latest News: VCOT now provides OpenTelemetry Instrumentation for Vinyl Cache.
• Archives: Available for years 2017 through 2024.

Legal & Administration

• Bylaws: The Vinyl Cache Project Bylaws (v1.00).
• Meeting Minutes:
  • 2026-02-23: General Assembly Meeting.
  • 2025-10-29: Founding of the Vinyl Cache Association.
• Project Shifts:
  • Vinyl Cache has migrated away from GitHub.
  • The project has established a new identity.

Connect with us:

• Follow on Mastodon.
• Subscribe via RSS / Atom.

---

Our VM is supported by various sponsors.